App launch checklist for AI-built apps.

Domain & hosting

• The app runs on your own custom domain, not a builder link (myapp.vercel.app, myapp.lovable.app).A builder sub-domain can disappear or change, and looks unfinished to customers.
• The site loads over HTTPS and http:// redirects to https://.Without it, logins and data can be read on the network.
• You own the accounts for the domain, hosting, database and code (not only your builder).If the builder raises prices or shuts down, you can still move.

Security

• No secret API keys are in the browser code (only public/publishable keys).A secret key in your JavaScript can be read and used by anyone.
• Your database has Row Level Security on, so users can only read their own rows.The most common serious flaw in AI-built apps: everyone can read everyone's data.
• You've logged in as two different users and confirmed one can't see the other's data.The real test for broken access control. Do it before launch.
• Your security headers score well (try our free grader).HTTPS enforcement, a content security policy and clickjacking protection are quick wins.

Accounts & data

• Sign-up, email confirmation and password reset all work end to end.Create a real account and try each one; note any confusing errors.
• Users have a clear way to delete their account and data.Apple, Google and privacy laws require it if you store personal data.
• Your database is backed up (and you've tested restoring it).A backup you've never restored is a guess, not a safety net.

Legal & compliance

• A privacy policy is published and linked in the footer.Required by most app stores, payment providers and privacy laws.
• Terms of service are published (once you take payments or hold accounts).Sets the rules and protects you.
• If you use tracking/analytics, there's a cookie-consent banner.In the EU/UK you generally must ask before those scripts run.
• There's a visible way to contact you (page or support email).App stores and payment providers usually require it.

Payments & launch

• If you take payments, they're confirmed on the server, not just in the browser.Otherwise the browser can claim 'paid' without paying.
• The app handles errors gracefully (no raw error screens or crashes on bad input).First impressions: a crash on sign-up loses the customer.
• It works and looks right on a phone.Most first visits are on mobile.